Named Kernel Exports Added for Windows 10 Version 1809

This page lists the functions and variables that are newly exported by name from the Windows kernel in the 1809 release for Windows 10. Another function is new to this release but is exported only by ordinal: it is listed among the Ordinal-Only Kernel Exports Added for Version 10.0.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

Name Export History Documentation History
FsRtlAddToTunnelCacheEx    
FsRtlFindInTunnelCacheEx    
IoClearAdapterCryptoEngineExtension    
KeDynamicPartitioningSupported    
KePrepareToDispatchVirtualProcessor x64 only  
KeReenterRetpolinedCode x64 only  
MmLockPreChargedPagedPool    
MmObtainChargesToLockPagedPool    
MmReturnChargesToLockPagedPool    
MmSetGraphicsPtes   before 1903, declared
MmUnlockPreChargedPagedPool    

To be clear, for it is unusual, MmSetGraphicsPtes is shown above as currently undocumented, without even a declaration in a WDK header, because that’s how it looks now in 2020 to anyone who doesn’t hunt through intermediate editions of the WDK. The function seems never to have been documented, but a declaration is in the NTIFS.H from the WDK for Windows 10 Version 1809.

Name Export History Documentation History
PoDirectedDripsClearDeviceFlags    
PoDirectedDripsSetDeviceFlags    
PoFxCompleteDirectedPowerTransition discontinued in 1903  
PoFxRegisterInternalDevice discontinued in 1903  
PsGetSiloContainerId    
PsGetThreadServerSilo    
RtlCopyBitMapEx x64 only  
RtlIntersectBitMaps    
RtlIntersectBitMapsEx x64 only  
RtlUnsignedMultiplyHigh    
SeAdjustObjectSecurity    
SeCheckForCriticalAceRemoval    
VfIsRuleClassEnabled    
WheaLogInternalEvent   before 2004, undocumented
documented start is 2004
ZwAllocateVirtualMemoryEx    

Discontinued

Six functions cease to be exported from the kernel in version 1809. All were first exported from version 6.3 and would have been undocumented except that declarations were published, possibly by oversight, in early editions of the WDK for Windows 10: